CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

Score
CVSS 3.1 8.1 High
Status
Awaiting Analysis - secalert@redhat.com
Published
2026-08-11
Last modified
2026-10-20
Weaknesses
CWE-829

Affected products

References

 
 
© AVABIS GmbH privacypolicy about